Primitive Bear

Primitive Bear, also known as Gamaredon, UAC-0010, and Shuckworm, is a threat actor associated with Russia that has been actively targeting Ukraine for over a decade. This group has primarily focused on organizations within government, defense, and critical infrastructure sectors. Since our update in early February, Ukraine's cyber domain has experienced escalating threats from Russia. While there is no confirmed link to Primitive Bear, we anticipate an increase in malicious cyber activities in the coming weeks as the conflict between the countries evolves. In a keynote presentation at CPX 2024, Maya Horowitz, Vice President of Research at Check Point, highlighted that USBs were the primary infection vector for three major threat groups in 2023, including Russia's Primitive Bear. Despite the attention drawn by Russian deployment of wiper malware in late January, a report by Ukraine's State Cyber Protection Centre indicates that Primitive Bear's recent activity has maintained a more traditional focus on espionage and information theft rather than system destruction. The group's actions are generally associated with Russia's Federal Security Service (FSB). The ongoing attribution of these events underlines the complexity and evolving nature of the cybersecurity landscape. As the situation continues to develop, it's crucial to stay updated on the activities of threat actors like Primitive Bear to effectively manage and mitigate the risks they pose.